fantom | f545b85449ee3812dcb219f173f010b76378a84acd3e5bbe1e7b2e308bfd7c64

Analysis

max time kernel
1796s
max time network
1642s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-10-2024 22:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fantom.zip
Size

164KB
MD5

23951f15badb4b0a89f6bfc7811b0d4b
SHA1

91d0c8260a8d285fea969bd701c6eb5ab901fa53
SHA256

f545b85449ee3812dcb219f173f010b76378a84acd3e5bbe1e7b2e308bfd7c64
SHA512

a3bf31ce8fb2b7dadf71a07e7765d110308aa419897f0a3dceb1e09be1c6322e69e043f500c5c3489388fcad4930a4795773bd2bbe2c232d5e8ca587b9beadf5
SSDEEP

3072:YsWGu6reSVacfSCgmzgtgXD6OOMe96MneBMOG/PVoj13KBMwIuGc/YYoj13KNsqR:K7ougpOL/saqkPV9FemLtcsDSsmw89p2

Score

10^/10

fantom defense_evasion discovery evasion execution impact ransomware

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>LdfiJOJN2Wg4qfCjS20NodaobZpIwhWf8Mhllwn93mwBRb/1gnIlp5pZIB9WgEIVhmFJv6u8tYKCqZiZOz7zvOEdvuB2iKpXhS9ag7VZP/zZ1SE/WwPDOw68d3ZfOM2ruUyenqSTbrNt2z9y6uPDlFuU58dxmZAOFylceGGH2WqcvXxUeBnZCBzdN8wG8nE2YDruLucQYyG4BYjYOMpg81lX/vXdltPSsNNXMCaq6dquC9zeu7QY7yMcz1i5KicOnlIvPHx5nszmSQ6Fl1ET5h86cywzk2VAKiRtx7q5ByH4mdHy5pcWBeFVv7HoCnpsar1whtmJZCk1EztXtCqA2A==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Extracted

Path

C:\$Recycle.Bin\DECRYPT_YOUR_FILES.HTML

Ransom Note

Attention ! All your files have been encrypted. Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets. That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us. Getting a decryption of your files is - SIMPLY task. That all what you need: 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] 2. For test, decrypt 2 small files, to be sure that we can decrypt you files. 3. Pay our services. 4. GET software with passwords for decrypt you files. 5. Make measures to prevent this type situations again. IMPORTANT(1) Do not try restore files without our help, this is useless, and can destroy you data permanetly. IMPORTANT(2) We Cant hold you decryption passwords forever. ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. Your ID_KEY: H+WVZXCjkTEyHMX67VPqgEUF0iisqlkx5ciXP5xyG8N1YMeaVIObaCqGE5AfnKpAqcQV2Ek+Fwn7kE3B0YQzXPPLfnAZmB+KHoUIYn+P+h/FGJgxEJS11Rl7plNiuCixW8DBO4FPEo9KmYLINmPlCRgZdxi59cN96aGuxNx2vTjFRedtMANBkbQ+uWc/RNsA3OQxbpPY96YsRvXcD+kbU+WrPycuA5l2wFPAbkwYe2Y2mi2Bi/zof8hwS2+ya5o7SXj878tpI6/3AsbxSZfJe4jueebarPkMr/P988hH3xITkMMiRQduuDBzJoH1xSGeCTfxWRUTdCqouYO9lTFldw==ZW4tVVM=

Emails

[email protected]

Extracted

Path

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>LlZeHhBFUoxvpoF0SPOGwyYFDhB+meYY3zUOPzCY9a0LpATLcNvQpRwRD/7B4CZeBN70mHS2II06bi3xPFJoutmOaDnsyuHMurxnzgP8qOZRW4uFBtDEz3HQTxbeAyNRwMoIgdYcVCj2rw2AwPPSYVG/0xJYphRRdsae0rHgGgSSuU6RlGY5MY6pKwovyDLn83yi73wBEtv7RYsh+JEcUrs4os/aZ2QjA7hGtQWG7fMiNXUYEMFedkstRT+eS+c3f1q5nvADirN3jgefwwGeDGUZpLLNKq7jqZPg9+LO2mDVzk/psa1ZlU0oBhsIXtdddymDMs1/xMM8/wjQ3RX9Vw==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Extracted

Path

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>mmo9+jZJNiCgOLKVFVydVF1G50XxNxwgqJ57zCNVD6ycuHSo2hdJaQOihwESzrG+PsJiAK7Ot4cPCabRnn/srKL8/29/FM2sm/l5g3bsgYOOEkfKnbWc0egJc2sIsDqyp7bQWySTHG+kMIhGS0hEcheVrUoBwq3LujKCHabyHVmTKgWkToI/5GOpDQKFc+AZi5HdF4OgJMNTKSMNL7V/3i1sgdkBMNqCte/0N2m4sIqK1cm4UgiMhLpWSfA/GH1eXWE7JyMwkiPhQ04OglfB6wDStE/Gm+fg2VdfnEdaUPZkg576k7oAJbW1lx9T3zXll0RTBNMYMY175iDyfQf4+w==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Signatures

Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
ransomware fantom
Fantom family
fantom
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (3019) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\gmreadme.txt	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\gmreadme.txt	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\gmreadme.txt	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\gmreadme.txt	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Drops startup file 8 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Executes dropped EXE 1 IoCs

pid	Process
1156	WindowsUpdate.exe

Loads dropped DLL 1 IoCs

pid	Process
2748	Fantom.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 23 IoCs

Web Service

T1102

flow	ioc
71	camo.githubusercontent.com
80	raw.githubusercontent.com
131	raw.githubusercontent.com
134	raw.githubusercontent.com
77	raw.githubusercontent.com
83	camo.githubusercontent.com
70	camo.githubusercontent.com
72	camo.githubusercontent.com
73	camo.githubusercontent.com
75	camo.githubusercontent.com
124	raw.githubusercontent.com
126	raw.githubusercontent.com
135	raw.githubusercontent.com
136	raw.githubusercontent.com
69	camo.githubusercontent.com
74	camo.githubusercontent.com
79	raw.githubusercontent.com
84	camo.githubusercontent.com
139	raw.githubusercontent.com
140	raw.githubusercontent.com
125	raw.githubusercontent.com
128	raw.githubusercontent.com
138	raw.githubusercontent.com

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\StarterE\license.rtf	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\Setup\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00x.inf_amd64_neutral_eb0842aa932d01ee\Amd64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\_Default\Ultimate\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\hr-HR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\eval\EnterpriseN\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\TerminalServices-LocalSessionManager-DL.man	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\fr-FR\about_BITS_Cmdlets.help.txt	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ehstorcertdrv.inf_amd64_neutral_2e1cecffae9c899a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_neutral_c86d6d5c3810fc04\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\HomePremiumN\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\eval\StarterN\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\LogFiles\Firewall\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\_Default\Professional\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_arrays.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_History.help.txt	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnts002.inf_amd64_neutral_ad2aa922aa11af2c\Amd64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomeBasicN\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\EnterpriseE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\UltimateE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_providers.help.txt	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netxfx64.inf_amd64_neutral_3336ecb2950fdc45\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\stexstor.inf_amd64_neutral_80ee226e29362f51\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\Professional\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_regular_expressions.help.txt	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\oobe\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote_FAQ.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_try_catch_finally.help.txt	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\umbus.inf_amd64_neutral_2d4257afa2e35253\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\eval\Starter\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\HomePremiumE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\RasCMAK-DL.man	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\MUI\040C\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\hp8500at.xml	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnkm002.inf_amd64_neutral_7c42808e24ebff99\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\OEM\UltimateE\license.rtf	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\spp\tokens\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_If.help.txt	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtdkj2.inf_amd64_neutral_0cf7696e2236ca4e\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmke.inf_amd64_neutral_3e4daa83122b1559\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wialx006.inf_amd64_neutral_ae607a72b46f9cfc\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\evntagnt-dl.man	Fantom.exe
File created	C:\Windows\System32\catroot2\edb006C6.log	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky003.inf_amd64_neutral_fe7ea176f20ab839\Amd64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky005.inf_amd64_neutral_8836be987024e6a9\Amd64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Ldap-Client-DL.man	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ph3xibc12.inf_amd64_neutral_ff7295ba5a46d63f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp004.inf_amd64_neutral_53f688945cfc24cc\Amd64\hpc5500t.xml	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_parameters.help.txt	Fantom.exe
File created	C:\Windows\System32\catroot2\edb006D0.log	Fantom.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\Enterprise\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmeiger.inf_amd64_neutral_492d4e047d14bde9\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\HomePremiumE\license.rtf	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmot64.inf_amd64_neutral_1abbad2f29c8fa08\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\unknown.inf_amd64_neutral_5eb6ac70dd1a3ad0\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\WMI-SNMP-Provider-DL.man	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\authui-migration-replacement.man	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_logical_operators.help.txt	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\Dism\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgen.inf_amd64_neutral_7a967d06d569b1e4\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nete1g3e.inf_amd64_neutral_7f08406e40c6ede2\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\ProfessionalE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx00e.inf_amd64_neutral_0a4797d9b127d3a7\Amd64\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png	Fantom.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sl\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_zh_4.4.0.v20140623020002.jar	Fantom.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.png	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar	Fantom.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png	Fantom.exe
File opened for modification	C:\Program Files\Common Files\System\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_rest.png	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_settings.png	Fantom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fur\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\MessageHistoryIconImagesMask.bmp	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml	Fantom.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\bin\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mousedown.png	Fantom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Thawte Root Certificate.cer	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\grayStateIcon.png	Fantom.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\flyout.html	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_rest.png	Fantom.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_cloudy.png	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml	Fantom.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_ja.jar	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\icon.png	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_rest.png	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\RSSFeeds.js	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-uisupport.xml	Fantom.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gl\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\Documentation.url	Fantom.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Roses.jpg	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\clock.js	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\gadget.xml	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_few-showers.png	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\clock.html	Fantom.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\cpu.js	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png	Fantom.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\platform.xml	Fantom.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_ja_4.4.0.v20140623020002.jar	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\cpu.js	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_settings.png	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_rainy.png	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\currency.js	Fantom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\utilityfunctions.js	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_top.png	Fantom.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationUI.resources\3.0.0.0_ja_31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\system.management.resources\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-eudcedit.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2e8cc16649d4b7bf\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..gbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c48b692b44972b10\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..epremiumn.resources_31bf3856ad364e35_6.1.7601.17514_es-es_19d331be95543ea7\license.rtf	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..oradapter.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bf9af86f3ce6a687\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\PLA\Rules\fr-FR\Rules.System.Memory.xml	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-opengl.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_2c3dceb2a8bf79df\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..ation-api.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f2a09db1b78b7636\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..d-chinese-shuangpin_31bf3856ad364e35_6.1.7600.16385_none_7aab2462f08e2d02\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..sions-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1974dc1c0e53e24b\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\inf\PNRPSvc\040C\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..core-base.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1d2f90411ea5c48a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..-admfiles.resources_31bf3856ad364e35_6.1.7600.16385_en-us_bac93a5f7499a27f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-shgloss.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d5c3561c0bc97057\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nwifi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9cdb308ed9bf1059\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-netio-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_b4c17244cbed11a0\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nlasvc_31bf3856ad364e35_6.1.7601.17514_none_c5abfb362189cfa6\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml.Hosting\664e4afe397442c26ea9ededbb639ce5\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ieframe_31bf3856ad364e35_8.0.7601.17514_none_dd82b9463bc08c07\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..-downlevelmanifests_31bf3856ad364e35_6.1.7601.17514_none_609ebaed9a394a1c\WSRM-Service-DL.man	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-msmq-triggers-runtime_31bf3856ad364e35_6.1.7600.16385_none_b51a463d5efb1094\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_678566b7ddea04a5\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..onal-codepage-20280_31bf3856ad364e35_6.1.7600.16385_none_b124dadefdf62593\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..rojection.resources_31bf3856ad364e35_6.1.7600.16385_es-es_70a6a334bc4b8c36\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_lsi_scsi.inf_31bf3856ad364e35_6.1.7600.16385_none_f85a1dab3b96447d\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-o..calmediadisc-styles_31bf3856ad364e35_6.1.7600.16385_none_dac1eab162daeb45\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..p-service.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f360a87309131a3b\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_9ba1049ce0053bef\ipsfin.xml	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\docked_blue_partly-cloudy.png	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\404-15.htm	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-o..style-layeredtitles_31bf3856ad364e35_6.1.7600.16385_none_4ad2978b8b3ac8b2\NavigationLeft_ButtonGraphic.png	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-tabletshell-adm_31bf3856ad364e35_6.1.7600.16385_none_c5302bd179bb39ea\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-artcon5.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d302b305da9d4d36\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Web.Routing.resources\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..lperclass.resources_31bf3856ad364e35_6.1.7600.16385_en-us_bd82e5faa91e3f5e\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_eventviewersettings.resources_31bf3856ad364e35_6.1.7600.16385_es-es_f2f24102adbc57b7\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-audiodiagnostic_31bf3856ad364e35_6.1.7600.16385_none_1c7c64ad096a7b06\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-dims_31bf3856ad364e35_6.1.7600.16385_none_0577c55a34a5a89a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-e..rting-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3295657625316fa0\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-secpriv.resources_31bf3856ad364e35_6.1.7600.16385_it-it_d97e8b3e5a4f18fd\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..omebasicn.resources_31bf3856ad364e35_6.1.7600.16385_en-us_77f885dc30a2b58b\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\Accessibility\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\Offline Web Pages\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..chrecognizerenu.ale_31bf3856ad364e35_6.1.7600.16385_en-us_2a26b846c28f1791\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Wind74b7bf4b#\d0cb27e1e133fe7ce60f172daa0b473d\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-rssfeedsgadget_31bf3856ad364e35_6.1.7600.16385_none_07861dacd36a18f4\icon.png	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..atson-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_21caf829e53758df\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ktmutil.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_abf4b8e877056d64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-qedit.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_a76370d3ebe415d9\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-msident.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b150a2048a24d21\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..n-clients.resources_31bf3856ad364e35_6.1.7600.16385_es-es_bdad5d9287414b5a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\1ea8ad2c4072a33cc9f2981dea3b8ddf\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\inf\UGatherer\0410\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Media\Savanna\Windows Navigation Start.wav	Fantom.exe
File created	C:\Windows\winsxs\amd64_avc.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_6fd8f321e377b09f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_6.1.7600.16385_de-de_a8eb5892654096bd\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\404.htm	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..mepremium.resources_31bf3856ad364e35_6.1.7601.17514_de-de_ab1cf971d3ad90ef\license.rtf	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-partitionmanager_31bf3856ad364e35_6.1.7601.17514_none_3fc218fad10f1ad4\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_mdmcxhv6.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8028880b4ba2ca1c\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ehome-ehsso_31bf3856ad364e35_6.1.7600.16385_none_ac3a9a3e6b4da0cc\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..mentation-migration_31bf3856ad364e35_11.2.9600.16428_none_ed889940cd85d5bf\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-inetres-adm.resources_31bf3856ad364e35_8.0.7601.17514_es-es_e8498c070b447d03\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fantom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fantom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fantom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fantom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4104	vssadmin.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2508	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
2748	Fantom.exe
2632	Fantom.exe
596	Fantom.exe
1880	Fantom.exe
2632	Fantom.exe
1880	Fantom.exe
2748	Fantom.exe
2748	Fantom.exe
2632	Fantom.exe
1880	Fantom.exe
2748	Fantom.exe
2632	Fantom.exe
1880	Fantom.exe
2748	Fantom.exe
2632	Fantom.exe
1880	Fantom.exe
2632	Fantom.exe
2748	Fantom.exe
1880	Fantom.exe
2632	Fantom.exe
2748	Fantom.exe
1880	Fantom.exe
2748	Fantom.exe
2632	Fantom.exe
1880	Fantom.exe
2748	Fantom.exe
2632	Fantom.exe
1880	Fantom.exe
1880	Fantom.exe
2632	Fantom.exe
2748	Fantom.exe
2748	Fantom.exe
2632	Fantom.exe
1880	Fantom.exe
2632	Fantom.exe
1880	Fantom.exe
2748	Fantom.exe
596	Fantom.exe
2748	Fantom.exe
2632	Fantom.exe
1880	Fantom.exe
2748	Fantom.exe
2632	Fantom.exe
1880	Fantom.exe
2632	Fantom.exe
2748	Fantom.exe
1880	Fantom.exe
2748	Fantom.exe
2632	Fantom.exe
1880	Fantom.exe
1880	Fantom.exe
2748	Fantom.exe
2632	Fantom.exe
1880	Fantom.exe
2748	Fantom.exe
2632	Fantom.exe
2632	Fantom.exe
2748	Fantom.exe
1880	Fantom.exe
2632	Fantom.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2508	vlc.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
1880	Fantom.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2632	Fantom.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	876	7zFM.exe
Token: 35	876	7zFM.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
876	7zFM.exe
2508	vlc.exe
2508	vlc.exe
2508	vlc.exe
2508	vlc.exe
2508	vlc.exe
2508	vlc.exe
2508	vlc.exe
2508	vlc.exe
2508	vlc.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
2508	vlc.exe
2508	vlc.exe
2508	vlc.exe
2508	vlc.exe
2508	vlc.exe
2508	vlc.exe
2508	vlc.exe
2508	vlc.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2508	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1188	1952	chrome.exe	37
PID 1952 wrote to memory of 1188	1952	chrome.exe	37
PID 1952 wrote to memory of 1188	1952	chrome.exe	37
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 636	1952	chrome.exe	39
PID 1952 wrote to memory of 1016	1952	chrome.exe	40
PID 1952 wrote to memory of 1016	1952	chrome.exe	40
PID 1952 wrote to memory of 1016	1952	chrome.exe	40
PID 1952 wrote to memory of 1620	1952	chrome.exe	41
PID 1952 wrote to memory of 1620	1952	chrome.exe	41
PID 1952 wrote to memory of 1620	1952	chrome.exe	41
PID 1952 wrote to memory of 1620	1952	chrome.exe	41
PID 1952 wrote to memory of 1620	1952	chrome.exe	41
PID 1952 wrote to memory of 1620	1952	chrome.exe	41
PID 1952 wrote to memory of 1620	1952	chrome.exe	41
PID 1952 wrote to memory of 1620	1952	chrome.exe	41
PID 1952 wrote to memory of 1620	1952	chrome.exe	41
PID 1952 wrote to memory of 1620	1952	chrome.exe	41
PID 1952 wrote to memory of 1620	1952	chrome.exe	41
PID 1952 wrote to memory of 1620	1952	chrome.exe	41
PID 1952 wrote to memory of 1620	1952	chrome.exe	41
PID 1952 wrote to memory of 1620	1952	chrome.exe	41
PID 1952 wrote to memory of 1620	1952	chrome.exe	41
PID 1952 wrote to memory of 1620	1952	chrome.exe	41
PID 1952 wrote to memory of 1620	1952	chrome.exe	41
PID 1952 wrote to memory of 1620	1952	chrome.exe	41
PID 1952 wrote to memory of 1620	1952	chrome.exe	41

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Fantom.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:876

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:600

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RestartSubmit.M2V"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2508

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5b99758,0x7fef5b99768,0x7fef5b99778
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1292,i,8620138146814745581,4662368995276754770,131072 /prefetch:2
  2⤵
  PID:636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1292,i,8620138146814745581,4662368995276754770,131072 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 --field-trial-handle=1292,i,8620138146814745581,4662368995276754770,131072 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2284 --field-trial-handle=1292,i,8620138146814745581,4662368995276754770,131072 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2300 --field-trial-handle=1292,i,8620138146814745581,4662368995276754770,131072 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1296 --field-trial-handle=1292,i,8620138146814745581,4662368995276754770,131072 /prefetch:2
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3260 --field-trial-handle=1292,i,8620138146814745581,4662368995276754770,131072 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3440 --field-trial-handle=1292,i,8620138146814745581,4662368995276754770,131072 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3564 --field-trial-handle=1292,i,8620138146814745581,4662368995276754770,131072 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3572 --field-trial-handle=1292,i,8620138146814745581,4662368995276754770,131072 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3848 --field-trial-handle=1292,i,8620138146814745581,4662368995276754770,131072 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3720 --field-trial-handle=1292,i,8620138146814745581,4662368995276754770,131072 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 --field-trial-handle=1292,i,8620138146814745581,4662368995276754770,131072 /prefetch:8
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1600 --field-trial-handle=1292,i,8620138146814745581,4662368995276754770,131072 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=1832 --field-trial-handle=1292,i,8620138146814745581,4662368995276754770,131072 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2724 --field-trial-handle=1292,i,8620138146814745581,4662368995276754770,131072 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3780 --field-trial-handle=1292,i,8620138146814745581,4662368995276754770,131072 /prefetch:8
  2⤵
  PID:940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=2020 --field-trial-handle=1292,i,8620138146814745581,4662368995276754770,131072 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1292,i,8620138146814745581,4662368995276754770,131072 /prefetch:8
  2⤵
  PID:2956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1424 --field-trial-handle=1292,i,8620138146814745581,4662368995276754770,131072 /prefetch:8
  2⤵
  PID:1664

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1440

C:\Users\Admin\AppData\Local\Temp\Temp1_Fantom.zip\Fantom.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Fantom.zip\Fantom.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2748
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:1156

C:\Users\Admin\AppData\Local\Temp\Temp1_Fantom.zip\Fantom.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Fantom.zip\Fantom.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2632

C:\Users\Admin\AppData\Local\Temp\Temp1_Fantom.zip\Fantom.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Fantom.zip\Fantom.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:596
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\delback.bat"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4168
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:4104
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Windows\System32\update0.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4408
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Windows\System32\update.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4356

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f0
1⤵
PID:2932

C:\Users\Admin\AppData\Local\Temp\Temp2_Fantom.zip\Fantom.exe
"C:\Users\Admin\AppData\Local\Temp\Temp2_Fantom.zip\Fantom.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
PID:1880

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
19bdf890552ddfda059c0c54fb285f95

SHA1
a4b64bd328112d93a23e6917a0e016369d9fe505

SHA256
5dc1508c224814ddfcfed1e0e299aa761320df387e8859098fd714e0d0dffe60

SHA512
5f6791f11af2fe68a11222e58c500882c2a305915e720408e4d0a849ad1dc82775a4dbe8c3e3119e09f8d573a846f0f08539339fb3c51c3630d0715b96833a68

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
9e4117c9d9a9eee54319f83cea895cbc

SHA1
628ddce58e298c7983bceb6260ba25536a3b6a36

SHA256
1184db266634b4086a39dff729cdcc6e607d32bb94b1ce192b61db3f2f8f83a6

SHA512
8b84c1ac909f246a659f2fb5c64fcafe5f6ae362fe4766a5b195d876b53d6e88c0e08c06629e8b3d78171be105dc3185299166ff2c44b7da702307d71a1b2899

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
6e85804473f18c19a1ab8fc94b2b34e4

SHA1
7d4b65152f82e61600bbc7a7e68f41666b7dd48f

SHA256
123727d9b00d0019245e9ee513cedc3fe781d0658118ff55b474c6d4633e5f76

SHA512
bcb5cb39f826c914856ed058e07a79fed55690e1970b90d4dfd8314df20321754405f3fa0e78d10cd5bb8db8a562a2f5fbff8f6b1445a8d20e9e77b865a98436

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
1d0aa00944e5d889564e086a00c0bda0

SHA1
7167d23ce88c6b88603f5264b043662fa56a47f4

SHA256
2b5cc5a5bef74b630228f7b56d0c52d3332601b64a94ece161f5e64189a3f314

SHA512
4790fe439cf8cb7c1bfa35a1e4490734d3d6ca35a6e47c386dbc2b68c1b3b0acea87aa746edf6f1ed2db2e82625ffc85f50391053bf0a096b21fc41cd6f20017

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\DataViewIconImages.jpg

Filesize
5KB

MD5
19726081b250ae83f70ee60f08ccfef5

SHA1
ba3554c1b198c3f412e14b7025fb79336b3057ee

SHA256
65a8925b36203a26bf6766b952e35c5647d5de21c10f4b8f348ff71e247382a2

SHA512
72be7ab0ebdd646821dfa7f6934ccb63d948628a9ddd7b752f073f3234dcf57d364446652e5ccc878a223b74fc1582f71de992ba7843368d45b6f2d1a75b95df

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
5af9df4e8cc7f10aea4f52ce3744d998

SHA1
45d6a22a37e3dee5b48c6e0ab51fd6510b2659cf

SHA256
2c7d880a43382a9e54e95e3472b4ff4ff3dd6be0befa3b0930c548be89fddeca

SHA512
ca9a6fd63d19b70ee565974457645a74669ab90458dd666ca449fb289a867f70f8bd41aa6e0f4f1b06f178638e39d2f5a768886dbeb30c3aa29f54d7b3da9b94

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
e2a5f894dc8e94202a7e16d98276c5e0

SHA1
81dcd57aac435648634366d29b2a464128075518

SHA256
584a9c4c88505760e2c3dec6ed057bccd8f0ac4f441b7444f045eb68c6baec29

SHA512
d9eb15f34a5741d2b3270b9480b2ce67a3bed609021e78428a75bc591fae9d4c058849c8e032d104e340b5f35d106302fabde3872e59ddc96ce9bfd30804dff0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
a1116ba7049d560fc1da7e2e21a776cd

SHA1
9c3b80ae4093469eed7c156c7d3a722f184b3486

SHA256
7ff97760b1b5c3a535ed6c777ca7be0cd00f01baeaea9706239c6087e9f9a2e6

SHA512
27e664fdf9deb8e68cc2ba955104d019ae5e6fc26244c2765f525d5a4393c6f160449ade9501922fa281d2c76d567ef865f06126e30f9231c96a218668a4d5de

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
708f41e1a36d1d251fe3bfc332501dc7

SHA1
ab10465cecba06204cf0167e51c1a8a16fa4842d

SHA256
db3584f5120ba2551cc3bb247efc786086649acd81efbfd001e542ca2b551dbf

SHA512
224808f39177c88e95e681152bd62697a90992221211b7c44cba7cb1ae429b26c2a8b6d6590d7ed8a118cd0f6a810a35e9a39c2b6b3ffea02b43efec29d96392

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
501fef8331a3ffc7501a6b18e1551d29

SHA1
00c99de87305c02640599f11dac730da1db21afc

SHA256
e2c596e694e48e81200a83897ca7e052f1ecef3751caf76813211f8b8f65e0e2

SHA512
4e35341ac9381df807c79aa7e80379ae0f23f2d896ed331d9868d0733de104979ad9fdd41635b9ac6236e7d332ec2317f58fa917728300adc46cab86475c5bc8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif.fantom

Filesize
240B

MD5
3b87fb4efcd0e9a4faaf6f413570747e

SHA1
72ee6e317b3a0e0fb0785b72800f8a58cb5ba998

SHA256
67ecabfe875c62f1a9f10dd0c97826adbd0f172106a976417dd05adc846c7345

SHA512
ae1aac37c78ae9dc53cf8f215f78c861d165d213a8a06dc8562c4a5eef5e8842d3be47262e7c423068f23aa466cb7b69ab83aceea73418b8803d11ca36c4c937

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
832B

MD5
3d1aa2c418414956db2c69a6d586f716

SHA1
3427b4d5cacfa5dd8de6192855a1fc6ebead4da2

SHA256
ea917fc318a988f744598b6f91603d0e83a60de379041bca5eefcfe58a649b70

SHA512
4509d807a508f41db723466c41bbaffb7a1b35834782d3010241e75d0c69f02b7e8c3608d0ac70669b8b497f14f7545915ceeb2c72f3140addd42f566054e8cb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
2310c29ce2935f235f576a1cf00b5a34

SHA1
a8ac0ea84ec80f39de4c792421b0b85251d83a94

SHA256
42618b3edeaf45e1c71339c827b3d42f7feecea4e49b6575d2ca1ab972872576

SHA512
8e8fd3b53d559bf9d39158489bdfcfa9187a1d3b90f01543c78d9ee9e2ed5816c205386ace4f1061f5044cc7ca66397e24090730858635357a3439c6f10c1d6d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
61e8c7b220cf44feac57c0f164e497f3

SHA1
b0a0663c37b0953f049773ff62bd6c603ace496e

SHA256
eb925738d0aa54bd5647e2a1ed21e2fd4859b26c3ac54afc1273c2627961d41e

SHA512
ca6a41e5cdc24c822f59cbef010a8eb6c394fdc7eeb72dae524da6795339141408e24e50b94b4b58cf5155b64274fb34d397ded9950a941bca5f670be9d9d43e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_OliveGreen.gif

Filesize
15KB

MD5
6b5e16daf65b5d273ffcc7135c50c253

SHA1
2a82170da38064952ba0d6731e83d688477ae46f

SHA256
7f2a50a552b54056874ef3448b87de9a92932b566d18301abd61e9e7c2c576ca

SHA512
909c2be98935c70d892eb33824571fdc086ceb0d1ea8a60e822a27a60234202939facf9c4e032480486a3df2761923745cc8519fbed88c65522369deb31e5341

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Premium.gif

Filesize
6KB

MD5
a5094d87f528ff4416825bf400929b16

SHA1
9d5d303a6849560bd113e65e3eb1d8dce6144fb4

SHA256
f751e8c060ad6a41da1858105d75f81c0b596a877d0532f218a56cf678cebb3f

SHA512
a70c582bc5b6513c5df238f9e51ad444c4b179683c186d53a7107b90a8e08e6977af5cacdcf795675db466316967622b9d88d346ac8b2948548c62301638ce6e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_spellcheck.gif

Filesize
192B

MD5
024fd6d4e26f9dc616f3ff3bfad31831

SHA1
5ce14096fd39f1719ed0914c04c474e46ffdbc5e

SHA256
9ccfd663f22f37ebaa9b65297ac402ca5a0428617d9ebc351a5873b5636566d9

SHA512
7686936e659185cedf702f541af36411cf822247bcd3db6ae7269030f6678855613f469ff196c4e9510b71d15f85573ab605a8295074cf498af44a0deca9e6c1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\macroprogress.gif

Filesize
192KB

MD5
0e41e3e837bcb7b6c99c51aa2adc98e0

SHA1
062d0813ca63b3594eef2f0c2cf0b07864841d99

SHA256
f84575610f06da9340ab7d1d22fa44cde8a87658d0381614c0439a4c200b6fba

SHA512
3377ea9eac427f6057fa519d430f5cba56af5c95dfde0e54b6a79c3fadf5a9e66cae118c92877913a604139f669114d69aa608125cd45b54951689ca9dd29c88

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
896B

MD5
e9e8da9e0e46e0b86a78b584b5cc73e2

SHA1
2d4d4986a00857ef370d9c4e2e22d8cba1ce9d42

SHA256
85c1d43805a54cdcdb435dad128e456c4e3c9260a71684a4486d7606c972e134

SHA512
0dd6e0b6f558865af2fa0f02ff20394a4bcf66014590081ed57f632a582eb7cd6beabedf4f8b0d56f3b5223e75be202ba7fc5d5faf5e00e5b7f82985bc1a02ea

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\Microsoft.Office.InfoPath.xml

Filesize
247KB

MD5
62c87b2bfbbbbf1364025e4dd59a5a40

SHA1
e40aa2e6cfb945e43d6fcede37881f61b8c92126

SHA256
9ea0c995d4a7066a4cfa7aee50b55735211ab4a1542d82fc74eb52c3c5c4c20a

SHA512
49f98188f676cc170d1025b2e00b8ee300ffdfc64521f78716645e8c3c5a0f669c437f60328517f7aebbdd04eabb77edefca7b509c3c05813a11229109ef16f6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml

Filesize
247KB

MD5
648009c72f27404a69bd789d440685b5

SHA1
64210ca0deea27a2daf348924551952f797634b0

SHA256
ba9b619d30276b5fa7b5bb26a1957d1d20371d6231864333dd19ddafbea56e64

SHA512
86fa476250f9f88fe4684f3802a6a829340934d0d02f6d49abc320757cb9e2c8c54a9e780215858184e6b832587b59d102254b0f681bd7d3807e761d806f2926

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
160B

MD5
ebab3d5c1c97ba2ca2b03feadc1a4dcd

SHA1
4ff6dfcbca26198e456e29541bcd89cf78ede897

SHA256
cb04b62d3068995abbf1c1016a05df8eae6bd8f9855e0a0bdcfd2ebf9e1bfadd

SHA512
cc84d9e0eb372e5d45d1e12641fca9d8707354524e80ffe632c783183718eea1c46efe2307fcb014ff499bf37430ec755080f93323325613a8a6cd00db08ef63

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
dee915c3de29e1c9211033fb6b7460ea

SHA1
48841364f0ee7432b8b5a1bb62eb70ffc4d5464b

SHA256
051848e4862191a826b0fadbcc5c51184d0e5117ac9dd9051385270b393a71b2

SHA512
cd3ab5020f2101f51f1daf99d426aba05a36b9d086a8831983f7acef1ed04eb2c1df59c26b2e03303110bff139df9d267595d34e836cda20687d3f878c3636f0

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
dfa46cfba2b5ae4c6a61e4d2ed973357

SHA1
b901e623bfab8384aad066d9cb52d06f864d3912

SHA256
6a6a7e9d525c47c472e88023278cabc5fe0a1dc14b1ef1b3a99098f7418a6ec8

SHA512
032caeece802f73c20f8dac02766cb4531d3aedcb9f4ebda2f0f13ea6751bdf98b1cc14e429309320906a3ee8ec7102b72ba35586a9f47bba1f24985e7bb3a2c

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
e2c2505196760f4e3dc7934b7cc2f841

SHA1
879dd18b2ed5dedcd7438bf552cf53a1a0aa330e

SHA256
6449e7f3003adde1c75db3ae3044a8873402d25f1f64944d0e41034a6183e582

SHA512
4cabfc1e4ee85860ce1f28f4c849398c8eb6f717351aa6b01d88283a0ab0378b93b64b873bbd48e42a64f7cccaaea670a5aa73f7dc6c8042c14c3bb7043b8f99

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
61aa20efd06d3c76a0bb07d4e21d53ee

SHA1
be8c87b0eb2b3a89399175656e1d999d4bd99af3

SHA256
7b11dfd0f99dd8420c6e0bbf4b1a1115ad14e014de97fb2b03e05c2d78a84858

SHA512
272f9e34a9aa328908a48aaddf630ab8eb297308369495626c007e5152faacc27ed05b86b35de095e6f8af0e4647ee87b5a40f827943c612b9a682fd9f16d3f4

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
86c900e9d96b7c75d59fc9c2c41db74b

SHA1
a3cafa289811d96e896f57d38739bed5cf165790

SHA256
a2e9104772e616491fdc0317639a8f0739af348e31f43c72d4922a79e6f69c79

SHA512
a48c6014229174628333e82ab36a0e52d035b5d152ffc5f8ea3fa8df9d50fa6bacde3d2809907359de20e6124fa3378b2bc7806cc89a257dbf4fa93c9b7fb4e6

Download Submit
C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
160B

MD5
2b58658c8c4a3ded0d7fb22e9ccc761c

SHA1
2b4d223d959c528234a56993ae4c3edb421290a6

SHA256
2ce59528b8198f198cdb2a850f4145c4b47b29c58f9625e11a3f55fc626fb805

SHA512
34fb21e2da8d4273580ea838d3e80742be39cb439557e5f16e0940d809db5d5cf1f49cf645fcfa96d7c413e69afc509450a63625fadc79dc410d1a5a18e7e1be

Download Submit
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAB0002.001

Filesize
16B

MD5
eb5d01ac71fad64b424fd908a527b7b6

SHA1
8dbeb79fc10f7c1c0fcfe3587ae410586790b27d

SHA256
61f788bb8a460c242c3451469f476f63557f10fd8d87f3a321c39624ae423258

SHA512
0fb1123b00195bd831ca5764b357a734600736e889deb68367ee1b753b655a5f64cad3ca98c7bc126e12c8946f22a032337929a7f19e5c11e9d0a693a3131c36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b719c525909343243dde63b86641c714

SHA1
0ca1138dffc5ab30ce04109b1efa8e6cb9cda9cf

SHA256
56b8364867b96950618bdb405fe9e1c2370e8e1ad07401435aadd84fce3a2fb3

SHA512
e4a4d0e23dd56cf219d20c4889e61f6eaed3f99744ef8040bb8e79ad8f324b8e1ad462edd2421cc0e17a911aa62bcaa9b2f91195108af50ba44a0fd6f95270ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef04fea30ad9d35f7f66ce6f45b7ebaa

SHA1
5146c479e8876b7f0a5717142faef76ef52b8fb5

SHA256
49d1a2f041337c327b898b298a6ca85e6eca7c8a0d1a0ae72fd7683c663a6666

SHA512
0ac8ae0af62bc796fac9a0d65ed6887b36cabe39827242331f965ed9d33fa9b27f0c6d4d0bb31e7cfea252f8ddb74323bf94f6c3f285f55ee7c6ad3941114c79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c759c8a16a4307be9204c1d17c9580d

SHA1
ccdcd9106c93f6c51677a17d6cbe196c467c9731

SHA256
216df348d5bdfd4463ab53f3c711003d178244c2ee2377fc5e4a9a6b225bcec2

SHA512
d1dc079f841894363c31409f15519514497e1724a8daf59a0888b7a10851c5c5a4039ffcfc1ddf349957421731ba84f9293cf4d51907ecc90f8bf76d92582580

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014

Filesize
20KB

MD5
2766b860b167839e5722e40659620a47

SHA1
47766dc72bcace431ee8debed7efcf066dcd2b59

SHA256
725a5e52a501bcd107624aafa44a857c00d02286fde07be774afeac2efed68c3

SHA512
a97f77977518ca755e9460cac34e0b5358ba98b3624c53f0e1ef7b947e62a6f3f99caf2852fb3132c822525d88b67b9c1ed778b3e40083d9df36028c85f73ae8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
7ea7a7c21980901aee6bf356701157d6

SHA1
84dc127fb48a579d8106ddd753508ad7e2c15bbc

SHA256
b5f76ca9cc946c5d58dc76037035ee12f0fdb707e29791a66c0de2f712560dc5

SHA512
a2bdce33007865b34c61db970b80630eb064bf42aadb70b9b29d8cfe35d68ea4e47a5b05e95560c268b8b65ed20134bbefdb138cea5deb5d1ed58efcfc416ddf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
2264d03f9a70f053f6e698f449bed46d

SHA1
ad4d6a622e2001e3164c052ea60744583344ac53

SHA256
7d5ed7361dc08689632f8954417ecc849bf37890aa06d24eb95714d93ef4fbd0

SHA512
ad9c430b10e162533e41bdf581f34e37abaf4541a52b16cbb8a5d3671a74ca0a1d2812ed326e2863025ef420ee6fc7fd4ea79ef8457044f90763024ffedfe0b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
0855dcea135b3edfaea12a20be6aeea3

SHA1
fed26678c10be613f8d9817ea6d61e3f0eb20531

SHA256
41fe164a38378e0c45f5a1f5d6b0168caf2e755e8dc96d0825242e8c057950c2

SHA512
9f156ef3f67444e8d39dc258a6d4a7e4b22fc49b67464b54e3fe3a10cbe2743e72febd3d2759f5bf10e0e9cedf79b4312a77accda09ee8852648205e04e70eb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
e7fe589757f47b3d788e9c0c0f805e7d

SHA1
c209bd3e80370669d67caf3be6dc71a7a53b8912

SHA256
6543700b9123deaec3a18dfa928570770c7daff5dfd932b0de60ee5702854c43

SHA512
6958015046721973a1e315003c40f6233b8df4f3fed93d9a4a0a2b4713d121ee09a98fa267ffd5166ec959409124996ee7de3c521d51ad5867c6ee88387b5cac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
853B

MD5
82a3c2747143a6c848d18b87536e26ec

SHA1
96efdf7b884372855023afca8bd893a8f33bee63

SHA256
634bd5daf04be18750721685cc1cf1ecf276101460ffc78d73c565d8589f1b33

SHA512
c202f995b7584902c379656cd9271312c3fa0b2c5a8798af7743f44c35e260d9acde98440c03b7b2b3dd7ee0173e6113734f23c6be43103277cbf223ab3c5f9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
853B

MD5
1613b7f40552158f2b2ee6b07c2ffd2e

SHA1
bb92953541d41a9bd89975f26daac23b233ff1e9

SHA256
bcc14ff4781c7a356a687284dde496513f7ec5420212db56913a88e9a8e12250

SHA512
c1650b2baed812fbb1c5ae9254c577278e085b8cc8cdadbdd1d48454a85e7caf6080ab85427e512e9a10f7be1312922b0f20eb87b80d5ba175004d1fbb609034

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
66fcea757605b2e884fbaa00eb170667

SHA1
3a29961cba8a38e4964725e14e7f848d97f10c57

SHA256
1e60c1ce36a5b51b4636ac51090350f56ea2f6967afa3afde9c1a617681c23a7

SHA512
e778878457355254b3e1213ff916a7366d62718319d38adaf990902c1289b61bb9f28c8033fb9fbc482ecca1ad90adc36745b24c9789c3a202326f5de797dea2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
fb24ce6ec39103a24c21d18e244d113b

SHA1
b95b1bb242133f24cf279fdacd90440bfcb7fbec

SHA256
a5333c38676c2e4a4e8b507dba538fef82c76d1ebf81fc203fa9ebb425e6f6e3

SHA512
4cf1af34c71f9278fdfeb47cc7f688cd8e911f69e53fe31013f082814c9e78ef76f13567129ec3357f10c2877ca52c70f1e050ced40045a9faf239109eda4201

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
853B

MD5
9a5164eff653569f2c3ada62bd8b7802

SHA1
755532253bb4441205cb16d6912390023898f4de

SHA256
f356376dd74cebf1e61d10a212b8c45bbcad131edc17db17f851f46f528cbc99

SHA512
d22d3ac29f412ebc3e383554e44ab203f7b22dfee7bd1f147b0468ed0b94234ae0e452b582d09d07a8e782a5e998252f17c7fa0dba20bfe52e77fb9e5c944f5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
853B

MD5
0a491c6148d406c4cff8caa3d9d4d76e

SHA1
f93362d13af31d58a8ddf663980fc6f4f2227c90

SHA256
ead70652a3ba01c03f09310a474b65fe64fb878dabd654a04a39cea80afbbaee

SHA512
a7892eac26a4cb4a824c3fd5bce29be1b820d3ce7432e42d94f6f9ac30fa62923aee1f96273b654b64e9280517404f615dc41efd20e2140e02df06ba1ac81712

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
853B

MD5
f2c698cdca85dbfffae638d8b5045564

SHA1
6c28fa9a39b569254fafdb9cd71ef203bbf7591c

SHA256
354d26f2a80829468aad3d8f402d60f822132b24c0827e323ae423b47a1bef88

SHA512
c2324f65d3fde7bd00115b257db31d75aa8afdfccad99bfcf0ed5aba534ba1f4e9e74098813bd1c0b4719fa17a0c1dd3a1173071797a6aa7a6027ddba8419b3b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
17d2c8edd321dd94f6639ffa5d90394f

SHA1
c71a346072f42ce823ddbeebb004ef7c2d3096da

SHA256
a1daff24353b621fe9f3be704e525b1ae8b9c643045f36dcda1e4e620b632c10

SHA512
d918bb66e3fa42347e851e6dc5dfa6f7d68d644d1d3378ddbf676e6df9466f0103bfdae8af92a2fd6ca1da81dcaac5c66443d830a1eeeb5a5f616e84284b2c7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
0c0e62815de68c05b815c765a94dbc9c

SHA1
8527737432efb8d2b2ee70dd8eb7326859203fad

SHA256
0ca27e6f356782469cb9595965af70287c6a9c0994e924c19408b970b6013319

SHA512
5110bf809b5dc32aa1737efac40a7c2e6274f917ad3cd9bb22f4f534ae46ec870f52ddb3ca4a6dc052cd08120a58167b868fe3f1f4c661c5eee29c068d3df89b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
2147c108ed476a3fa537ec5a2b5b16b4

SHA1
3e3f39cf33a16e67cfc051b0f0019b3a2c9523ea

SHA256
5350eea68ba7cfb5b2b6b716f4e06d24fdf8dde6812b18d154535a11b61b8bf7

SHA512
987643d2151292ead71de07726a948bb28fb4fa83c50a07043f6e189a29a1e9777e6e3d98c661cfa696942a03da39adcf27ae352919d691c39711afe58f62456

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
e9739d4e61193e2f544dee9571d2b901

SHA1
5046d02bf5bd3ba1903a0a222d3498efb984df06

SHA256
32e7964b3c39e62109c0432a87f762180aec8b9f763035ead8763a5ba5414798

SHA512
9c7be52f2cbd34fda7766f364daa26f24527b64b56d33bbfd118dd87a2219f3a448a0a60daa8b4b8943a9487cd2433719b0be9e81f7d3c17bf2684148982dfeb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
3da93b12e8cc146677162acf17e9e03f

SHA1
b46e1a96b19171ea08e9e12ea4f2c22dfdc86f19

SHA256
cc7ca016d93d4fb4e3ed99c7b9879c27299b818956d16a0aaed975ebadedb827

SHA512
f0e297c7b55cb56045f675587c293d37821ad46cf3cdd553a9078916b9a3f5edf35896d5851960c9fa73cb3c70df10f7ec6a4c3dc393e4ca57ebcac94ce93ef5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
2f3139cdbaefe4c612348547d83a41cf

SHA1
32f45e192b42bfda046a419c083fedb0d79c559b

SHA256
20284b84650f4532152f9eaeff2ff5f2207f97e98d76185466b6de3e4bbabac2

SHA512
77f3116f52324d3dd7673bf6151586bd2524d245226cb1d80963c24c04bb7778174f134bc585d98521e19bcc27ced99f494215c80b004eca4af3ec75ac915fb6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0a28689ad2430c7f04e64845fcc5ed96

SHA1
2ee866bf30e99a886ceedead672f27a6d0057e0f

SHA256
3ec0bdccbdaccb29039ad57eeda180c8e885e33c8329b5b160af50f658b7f4d1

SHA512
1ddba7689588c1df4596afa6cb5eccf219fdd98c34cbedbfaba5ed2ecfd6bb2693fa434fce5a53291727c47d3b3b4b541a00ef94fea99910bc4f499891d2400f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
3d066742a9e96a89bd64b6803511b9e5

SHA1
9ff3ca53a08c17d7d8968d760a9df879da52204f

SHA256
7442415db80cda011cf7e4126c87dbe965bbc8971d46977d7e751396d621ff84

SHA512
0c59991b2902f671f03d34c88de582fa3f5b38339bbb5749f45430cab38720f9544ffe8d4cbcb0eed92c7234dffaa6b1a3f5b069af16c560b494c2882f56f17c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
75KB

MD5
1064e648b2dbec2ad449ae6601f0807c

SHA1
37e8186463e56d77c704405deb4a3b74c2372cb6

SHA256
25915e2988331d281508974a2c9136fcd096fcd7cac58f4b5742740c0d36aa9c

SHA512
5a171d5651652294dd0e60cc3c881f3541510139ae083ceba436235247d8f10a0a8794c42c707d2f9ffb770f78d766024e2a8b066bd996999939ceac24ce3e0b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
76KB

MD5
2fea21cb845ff6803e40c8c3620d52b6

SHA1
2b283adfe93d894443668a7f47a28ca0e037985b

SHA256
5442b0187ef2f9ed9b738585236e983ae1d33bc7a40a6d344c1f1586f9531463

SHA512
0b95e43457c194a4c57e03600894be571498d9c2b58b3517e84e9a7c9648399258fdf2165e1631cf6252194c676c2d1c2a333a251d15838f803f6615477dcb2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab77B1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7841.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\Desktop\WriteRevoke.xlsx

Filesize
10KB

MD5
6d665ac80b0d5797f6ee9853629b2410

SHA1
d429e4851a9db77482853ef6a9cf15328d188dde

SHA256
e9c67c22260d071d9ad39238b3fcb4a8cdf5cf960835756f675f7656cbe72f7b

SHA512
32e8efb14e61bb04a842074880cbded050ae546333e7497ecfe27611ca645fd73467da448efcffae469221655b44bbab475d961386572ffbc70724dd21f70d82

Download Submit
C:\Users\Admin\Downloads\Fantom.zip

Filesize
198KB

MD5
3500896b86e96031cf27527cb2bbce40

SHA1
77ad023a9ea211fa01413ecd3033773698168a9c

SHA256
7b8e6ac4d63a4d8515200807fbd3a2bd46ac77df64300e5f19508af0d54d2be6

SHA512
3aaeeb40471a639619a6022d8cfc308ee5898e7ce0646b36dd21c3946feb3476b51ed8dfdf92e836d77c8e8f7214129c3283ad05c3d868e1027cb8ce8aa01884

Download Submit
C:\Users\Admin\Favorites\Windows Live\Windows Live Spaces.url

Filesize
176B

MD5
aea56784848b0fe8d75fb4fa35651311

SHA1
50a6c393c0bdb8b3b003f290934a4c1a6b55a2ea

SHA256
4d495a68eafd2d0c5e28ae8d623eb30b4ccb0a24d5073d06f911942fc2bc7866

SHA512
9e4d81d3a3574b5730936d9a2f62db58a1269eadf0d0e6aa31e2b4a1ab875110f34cbddc8b48950226f84e83730f3fda335eff339048ab7317cef65b0a7fa2bc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\DefineErrorPage.aspx

Filesize
17KB

MD5
2f8020e68b089027681e485402c8c493

SHA1
e05fea1a25487e2766db212918411fd285e3ca7a

SHA256
445049fa22da8ca125715feaa5f49c85f97ff6c0211ad02386bc9aefb46ee146

SHA512
30ea0485ddf9cd4d1ea995de11c76daef8a9714cc0b188da5f189b8edb811d687c210f49377e0a1e00c00618e443ab515085c76618d4b1abfb9438036e2b07cb

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_sml.gif

Filesize
64B

MD5
e5599e1a4480e4806d7dd5e8790d4a0e

SHA1
fc2a048f90a16d863e2d7ef45e89b563cbe7f33c

SHA256
57141750d20a3390f53b5a1d08c87c4c6992d6fd7e94210f1eb025b836e209d3

SHA512
f8d925b11f1e697287b468b241fa09a4a164391f5d389fcf0a2989692841685c2c0329bb6288e44a066725493a153d5557c87509c2359a41a66a0aa2fb42e814

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
208B

MD5
b029dab97404e29e01357128f4803c21

SHA1
6031ae1bcdd969090b1922b66ff3998c10540322

SHA256
c89c978c9d981f3669719a358851fda4cc9b89c37b2e00679f973f076160cf0a

SHA512
a869d3b05335c58fdffffe1ef8c6cb89c6b525532a38cce234b2a7f77213bbc016ae394b2bfe78e43b592807c06fb1802fa23aab7e0979e32dd13d530978a4af

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
624B

MD5
2df00a759a4f1aa7b57e2a701b0ff947

SHA1
60800656248bb96494b65e6aa4ead9a6ae60e665

SHA256
46ef9efe42f44778c300b11af011d2e499e89320c9f2cb6990d717ee821883b4

SHA512
4541821f0afd6390725211a625af7e2b5b555f72709461e33fa75525a1a6cb449da9435237a8dae8ebd340311293d7f46bb5dfec6f8a80fbfd2272c55afdaf6f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
80B

MD5
d252ab542aaf64a85a342bc3a77cd5b8

SHA1
88ed25ad5f2692423f83ff5e5aa4fc57d10a4721

SHA256
f8acd65b01853356f421305cc550d39cb71f1482bae3469e84729cfb2d2dbb5e

SHA512
d566dddf236c463b1a836a1d52fa611718003c188f56c1b6ed6ff96fb17b40f42092b5337edf26679963b185305fe5467bd3089dcf83c8396c7859cdd8a2fe97

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\manageSingleRole.aspx

Filesize
9KB

MD5
d2922028eb6d53f24675d65d5b8cd0f1

SHA1
5683d896f4db12b512e517b44ef2f317ebe329eb

SHA256
a0888d2b57e775370f5a91ec65b65b70349101520a3bad426995ef0c24a356bf

SHA512
85c44b4d9b3ce4534b75e5c905e0f02548f0082bd13df4047f3a9432081d7332a71c528e669b018ccdbb21d5ab1c46c4b2245ed6d89ec9a1546a22c040360302

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\setUpAuthentication.aspx

Filesize
2KB

MD5
21ae48bf518c146b8152212cce83793b

SHA1
aa38f432a62be9a450134dd2ae4817bdb036a7a7

SHA256
8badc08045dbb098991c7b49f0a64efa96aff3d350ff24f2017d52f1da81f752

SHA512
7279e8020a7aa96a404cdcd49efabd1de610c6133734f41bc1bc466fdcdd1fa28d98dce3f63b1d28212a2a9350c66d2cc218ee5c510370238a650c05fba625df

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp.aspx

Filesize
6KB

MD5
60063e2932f167ad406770a08e5ae17e

SHA1
6332ddc10ec7d78b212f8e249c132f665b5033b2

SHA256
fcfff84e23ca62c8cf4335ff0b49e38dcd9e02c255f298c18ba09e0241719faa

SHA512
967152a17e6b0f22e7d5e630d7b1d4759969caad2433995e178beeb85c6971018a4315b5e465174ba979e21c80a1a509dc96846c69a867bae198c2dda3d6e9f3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Application.aspx

Filesize
13KB

MD5
ae4dca9a5f182303bb43084c8e2e7539

SHA1
6f5a1f670d33a8083391932cb1c1c27594b14a64

SHA256
5e24c258925542e0fe78a86c7b299a930844c76e097213bc623f0fedee898b35

SHA512
85a04ab5451ae6b093a1263e622b71a5729695c5cb835bfc3ba23e7217e26ab1cee56435fb8e1b01e63e5d0c85470593b35b9ae1132d6ed0e63a9770949a1d4b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Internals.aspx

Filesize
3KB

MD5
42822999eb5c5d1750a25e0d0cadf5d3

SHA1
b5dc35d3414e299df1291c227231943cabbe3239

SHA256
d640cc3efac52aa59a6179242456670abfe743e210255ce67bcd86976c3b7048

SHA512
7238989500c32fc35fd08a6ff8f5a561daf3cc1b37e84d6309df0dc54c94ebf4f83fee93cf5af8452726b11281d13c51c1f95e119d90d398908b27838e4913bb

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\default.aspx

Filesize
4KB

MD5
c758f206b89fb04ce5755e743e76b59a

SHA1
afb3cb5472f24b67a7c70cca1b3921c2f18cbe15

SHA256
61f11e816f6222e852a95fbfe1bdd4c5e3a4fc069a3508498275530306942e77

SHA512
9d3c8853dfc1132a9cb83274a2bae21d701718fe7f3bd58a8008932ea8e11a4024d2604539cfa066e66d002aff1e4709eebfaaace9e19065ed0e3d4afddf9894

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlStateTemplate.sql

Filesize
52KB

MD5
980583d62158a654e296213a11be624b

SHA1
2a7552d4836165cb704a9686c6dace00db0a7212

SHA256
739d680259b47a0e9570b7ee60a5ecfdd68afde847429a993da3745a2a424077

SHA512
574ad3ac956cddb399c12f7d38eccda30f8596fdebdc0b21053ff2388352847072a0a9fc8482b048f3af5394744bcdd066c89cf7a886a05ce4d1a4b2e0ccf096

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlStateTemplate.sql

Filesize
52KB

MD5
6b59e8662ca6f4dea554fe53add40dad

SHA1
b29c8c8784a7592a84674b216ba54ca0065254a4

SHA256
552e84e68ae61bd9cc25e98d1e21a598d0905d328a81688cb834d3e760c27c10

SHA512
857b1564ab2ad589a0b5f7782f4b8cac36492d25a5127302eb0a75e7985bbf8d1fca49d91585727a2b7be7e302ac044d4f6204db5f9b90d0d465fe62909ff52f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallWebEventSqlProvider.sql

Filesize
2KB

MD5
a4e3eb5b2042f82cb85a9baa967dab47

SHA1
180bc8b6f20c7a15af08094a124a76a8acbede77

SHA256
1d88e829e8c7cc15fa408ec26f5c0f3770f75827ccac90b78856b34bacab4b86

SHA512
fec0c504e28d693468f83633af2c5135f2297469d31c3ffb2ebd75bce9c4f8043b2e2bb15d150eca0a721bc7354a8bcdc920b1f530bb89b7474efe3aa35cd5cc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v3.5\SQL\de\SqlPersistenceProviderSchema.sql

Filesize
2KB

MD5
e413d9bceff6290e2644a91026084bfe

SHA1
2335baa08d4561dac418a1a2f971e8fc49711ffb

SHA256
abf5b7cc52126225f7149c72638ed2166f4aa05390de57f9e8dcbbd5e878bb10

SHA512
a038aef202b0c4e03ba77bc13091b8da52973dacd15fdeca8da3f05be96cb23bbadf6abaaa1ec60c87969122626c8f6892fdbd382612b6d2db370ddf1a385730

Download Submit
C:\Windows\Microsoft.NET\Framework64\v3.5\SQL\fr\DropSqlPersistenceProviderSchema.sql

Filesize
1KB

MD5
2cece70808a973747a49c20e48f4366f

SHA1
a71f114f4e6cc41aa90837e3b49992bc106c7a3a

SHA256
730181568ef25d09930e0b834cdcc6fc1c782bcde2b316cce9405e5c51115084

SHA512
9ceff07cf83270f66805cdd5c92bfd15a5deb0b104740edad4c2f236f92ada9c655eeace53777dea1e5f9b2de8cf29a29aeccdc3289b72da4e2c2a2fc5360b4e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v3.5\SQL\it\SqlPersistenceProviderLogic.sql

Filesize
13KB

MD5
93aa8558a7efc413e6b32d13d2c4c4a6

SHA1
9757de364164b45e78cbe56bdefc8faaf45a1abb

SHA256
9be5741d3336c2a533402320addacde7f35b567319e3dbc91bc63125f773c404

SHA512
6fb0a703c5c2d4c6ad840e69c33c6a8b32baeda659ace598420dd8cd57c5790165cf489a3854ff198b66d39ff46a5c3748dd91ae735dd30b3743d01cb1fc7370

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
192B

MD5
139f013e83365cda23483783cafb6b51

SHA1
88b098ece9b92b14d4a191dee298725f890690e9

SHA256
2ad5b23793a058f73d0a2fc693e060313ed8c0d35d3795e5bb2421d3d94d3889

SHA512
853a05bffc69eb158858295bfde69fc703f3e6f2c103a44743fe26df204db0fe3628a6c5d2057c595e70ccacfee943f4363a28b768ac11dfb560c0ee78fa2033

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg

Filesize
64B

MD5
6dd8ddbd432672b64530d930a3219034

SHA1
89fd49207e7622fbf854a0d8a9e7a13e5b81269a

SHA256
d65cfddd3be27f06985c0a94c0824d706c3923bab73b1126a40909a7c6f588a2

SHA512
0d62220cc700de0dd9ee461a995d105ea3c6984ff385b448181c3347067664942a3cd142b0e708dc041f59b8468da02d074ca95b5d1c406d1f4cc9413a4540a7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
9f885c9f4a56a77c4ec5f648bf3089b1

SHA1
0e61842c808ea872ff229702976248bc2d028854

SHA256
b2fff0a279587fa68ea1dd1162d2f298a0567b9e0840992ddfdbdb346a71559b

SHA512
f7359e4a8b247fd7e4bf22cb03097f00a467af23e0bd3224a39bb244fc3ef84aa8d28ed9ac821e7187cf07fed4d262fcfda2e19ce7df49f64f63b3c229e61b41

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

Filesize
80B

MD5
5541b45b9710adc5176d05369b62570f

SHA1
27f27ad803679ab3c8a3d5f92b855fa722208e01

SHA256
60826e935796b5d1ed247bf8ec04559c2627398b6a69a0ee99022389a9801a7e

SHA512
60af5d8501e95a3258ec6b703bb7f3e27cd4d3569de7d06376b2801d1b7eef469452bcfc662b9c5b192735b2063bc65b00bda7b4c0c611b63c63ba1c22771e9d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
896B

MD5
503fed8b08d758845845a657a653f095

SHA1
5453e77eaff2d57a46e53ed82f4ca7a07e38ea93

SHA256
e32abba392a331a36c04653bf6b8760d14d91d7bb464e06c8320506d36ddb373

SHA512
9dbc0f854b5f4489355af65699095ae330c3d022373c55ff8dd864b04c5194f5a9e2f9b135fe758cf43779304b31ff13816a83dbed96b06b4c5ec335fb812703

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Permissions\managePermissions.aspx

Filesize
21KB

MD5
8689ac06f78791491af0b068800ee923

SHA1
ecac4608721063295761a8781004bcd8801632e5

SHA256
d1ec391b6a3d61e289f94f62098f4852bd8bf637187ed85aa13d2781d3c3139e

SHA512
0094df2ace1f42d2f02d2817490ade49ab9abce13b9a757427f149bc0c52e042a8600b02680321c5c88c00140baa4903122ac413a3bc3a1103ae6029ad575d73

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizard.aspx

Filesize
10KB

MD5
cf5a0a92cbb98a70864f56e1485eb268

SHA1
c05d9410fe6d01af862256be7f48608e80b74f95

SHA256
5e136d318ae4b8be43a014bad3adda207e9e71a138cb5afdc36412f4e5be494c

SHA512
107b36cb016003f5c57936f884d797a52e8a6b0b609850f3aaab613a4e42c2f9fd3d917efe2a65be5b797be8d7e4f9102cdc36409240349dab0897f1f199adbe

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardInit.ascx

Filesize
496B

MD5
af2ed85e96e94b76aa02b84493486c05

SHA1
91c5e3d5b6bda58a96fbe3d99a9872e20d5fb20f

SHA256
6d5bda14a5572aeb3c5ea60f7338a98c19c50b778c6a94c1df848811c38a180a

SHA512
b62f23017ae119f734969c223b4c3e8de441c0a7bd261fd41d42e4f14626d3072a8cae87806eebd827d8d1dd38f8f54056c81e4f8307272f1f0b76216fe07746

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardPermission.ascx

Filesize
24KB

MD5
525f6d71a2e80ec2cb9d89d3aa7d83e6

SHA1
2f9d5769bf461c6b3ce4f4cbf7b1059e18c38512

SHA256
55beb44f0ab620624d28ac73eec7853b5f0d6e2fe58d169cedef4615fb76c78f

SHA512
bd8ae28fbb032747a201c73ca5f1f2a6dcf09e599f793372d9653c4f7661f73712df52d1f82331496f813d72f1b3dae16ad4fb5aad9681792ece0de42e78de2a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\WebAdminHelp_Security.aspx

Filesize
10KB

MD5
b2c1bab890c18eec7cf4c09474a52ad6

SHA1
7d776092941480d85d8603d5446920cd2721f41b

SHA256
6697f0bc7122364898cd01a1cc16282af2c96ee60d4079ebe8e392fe56b708d3

SHA512
703ec9d71689da8931c1141b655b79c8aa6a2b1caa3443988914864829eb7d50ecad4ae18b6913aa6b939ef30c16bb295ae8d1357990db00293e841c2b1c6347

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\navigationBar.ascx

Filesize
8KB

MD5
346822c7331a25a640690f4004b4bcec

SHA1
5653e11d30ab8df84bc01b33557a9ea4eb295d60

SHA256
6ee8c642ff2c2f49888909401a5f9f41286225a214b13eab210e9c23cd4d465a

SHA512
9ffb0a5e4b0b6213ef3c2fc7cac50794febc95d14da1a7a8c4b3dd95dae93c202487316c135b8d595c045fd39ad83fb2444b3090c339d15bcd705ef1eb846a09

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\DefaultWsdlHelpGenerator.aspx

Filesize
68KB

MD5
9adc79e7f55fd3c5e39cdd7f9a4690f7

SHA1
a78d8feefab3ac88a5e5503e959e5926d941253a

SHA256
2cd7987e4238ee495a6de5a5d108986fcb8b45bacf37ab6fc861ba439886d3b5

SHA512
b2e4322790dbd394788e3cd5f643e5cb6f31ac5ba70ea3ce1af9794e112ed5793feb17ee3cf759cd61e572673ed0a1b596a402e40b02b122003bd37bb941d019

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\DefaultWsdlHelpGenerator.aspx

Filesize
68KB

MD5
690181112474d323c228599601ec1019

SHA1
21dd2ea0c8f9cab15e8b1bdb9f0d6a039390952a

SHA256
62d97402c9ade60b92473ad104c1f10c1cfcc4b921407c4370a1940aac16c71d

SHA512
2405c5ec5e7dcca22ee69dfa762d1eb81544a32fab477405ff8c021a5297984844f9b74307fd11334c48e0c49c7837007a06b3b36be16f0c9e0f1be8806ee321

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallPersistSqlState.sql

Filesize
53KB

MD5
af8682045aaf7323a3a009fb51cb3f03

SHA1
4a5f5fdd633d3fea4dbf386b21534ebd6c750ea2

SHA256
091060583753d3c1d97f8c3353a228a57cb0261db0a04278b2b4a13df0d563e6

SHA512
cee3bf3733494a810025d3bc52c5ca4c0347296b3680765d46248e76a9be71f26c908b4b24e74ff61fc7535ea2b06e732d31e4dc1f380744d2be247876ffa88a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallRoles.sql

Filesize
33KB

MD5
c55a056399d3a13acbd6990400df726a

SHA1
856d00b2310003e63d0992eae70e814fd301dbd5

SHA256
ca329c07a465ef8efa80e87e7b397e373d25f1fad3ac7591822083f65bf7cbc2

SHA512
78a5db9d712a536d524d7af175bb3c2b7ae1d7c592845e8b096455ab0e385f4a47bd1c78a709b7c51e7744345170755bd4f5c8e6f4e4827a07295a649b96002a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallSqlState.sql

Filesize
53KB

MD5
c43563dee5cd72d1ef55a79bd2d3fe83

SHA1
12a93514788dcbc28c3c229f2361d7c9e5c887b9

SHA256
5bf76b0a81e36c9a5e8afed24b3b088747793ecb9ff3deae5323245a8bd63316

SHA512
17e0342715849e34ce84472c5a8bd759aab492b86f9f8a54f4a9eea959663a615f0825be153193f3df28a26b3ccee0f01c8e2b0ca0e2a3f7ef08cd8eeb3318ed

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallWebEventSqlProvider.sql

Filesize
6KB

MD5
219a73e2abeb4eb443dd926c78d56a69

SHA1
d1dd4af523a35627ce79d0d583ffe55baaf2f070

SHA256
acc4c9830731ea887a4c571a0f0a593f6dbdb24ee403f4baba13bc160e8d7ae4

SHA512
fc1afd964601c3fed9a55118639f795fa21348f1f180be6b9357b9390e6503fd0b8fc9ff4174d773bd9e5ce568dba791cc3e57867f6b14b830091301c9f9b14c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Logic.sql

Filesize
372KB

MD5
172c9e5faf23c31e51c62d514baa2f0d

SHA1
287bc306587a63359ef598ad778278787aaf4395

SHA256
415e3b67765f2cae33ef062c3e6f109c3f7ddac728da075f2b67909b8895ce6e

SHA512
9488f04aab4942d101471461fd5fd291d0996f0bc78fba9f23e6ed2336abce7a9a58ede80d1e1b1df06ef874b8f8a7224ea00bc1fa8ec4d58b173ca1a67c2301

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1043\LocalizedData.xml

Filesize
85KB

MD5
c413a483d037fbc8387993ed4ed4168c

SHA1
bbc96613d6e658557c8dc889ae26a026c8fc99fb

SHA256
041022501101d3a899c16772b0d3d5adb381527a8b6ff14971347b9501a2eb43

SHA512
4d6e35fc4b524b05c3591897f293c460e6a285e746d481a081d9bf3f0b1cad17e729d94ebdf74f3019600f2e866a2511764a5cd7f913f30989ae4e2eb3558f13

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1043\eula.rtf

Filesize
5KB

MD5
77ef6d93b4615e765caaec39bf259905

SHA1
5527fec40f447b78f0fe28dc0205c0e4fa0eb4d4

SHA256
8a04498cbd77a392722fd3c139af420e6a06c1cc3ba675e3f11e59af39cc85aa

SHA512
ca351171d14600a31b532a45149a8d7020f4cb8af24139551b82225073a120e0283bc20bee2236450b544dc247b4df1231f30fc36e4eecd8ccafc799cc45de37

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UninstallCommon.sql

Filesize
3KB

MD5
273a77984ccdb10f06cca8c14fb39cd5

SHA1
f2284e06c48ae24f2bd2cd0b16f306b641c1cba2

SHA256
4e1b14433d03ba7096d043774eb3f7ef55deb9ec8e0e08e606dcb735c7a2134c

SHA512
d8db612a2e8f55c4004319e7827357320081ae8c060564b6fbe8adc6b1fccbaabbeac175eca6172cc81390f96c8c5db9fdfbbaeadeafb0e024c71a10d1032285

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UninstallMembership.sql

Filesize
6KB

MD5
dc66d0d46298f1f53503d2318993a51e

SHA1
f81ed8352c944dd02f5b389f38c5ae4b40e0e6d0

SHA256
53ddc1f81d024a8ccdb9fde38df72b0442306c65e64b25ced08d3b8e6cb47340

SHA512
583783178b87c4584c11841cd217d5345bd75382da5b3563cfcbbd26f5466b77dab8bf0cd7c9af77cab44d5565a640e6c898fcaab9ae32b60a9d734bf73f723b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UninstallSqlStateTemplate.sql

Filesize
11KB

MD5
ac2a4679edd2acdf391850465797894f

SHA1
5e4fdd1126253fe850cb83d074207ce4ba0e314a

SHA256
87a37be2971311f691b04212952233658ffe10dc40414c65667ed505440e82c6

SHA512
448522fd727c2795cdc81acca1e8c8305a5cf06785c55169d24bdfce132f6775180afe44ac01fbccb03847ae429bfdf97ee589fa937ce7accd93e0b3a75603e0

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\DropSqlPersistenceProviderLogic.sql

Filesize
2KB

MD5
7711cf4d3f10c03b9522326f41d4476e

SHA1
a9b41c9a497fbf19a98862b333120b855ae1f037

SHA256
3764fd56502894edb24c19ce6980bb256ad220c894d61b371962ffd2ae4cbdd1

SHA512
d0bb8618ee8deb1f7c018feea2c55eb2c304ef1547059339a6163885bccf8c091944539a39cece17f67a36915512300dc8db4e159726aa589fa5f617eab30e32

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\it\SqlPersistenceProviderLogic.sql

Filesize
13KB

MD5
6593c89f35415873e121d7642997ca95

SHA1
66d04bc51140b40ab8a80cb6dd1c59c79a250200

SHA256
5f4ab5b43f7e1a4331f142b79ed1c08c68982c8739610377d28a2fdf0e509b03

SHA512
2cbf88c5bf96476d804fa63d69156385949487492bd4fac53cb022b3f25f94c2e9127fbad562e3825cbe07c71db3e5e51ecda223c858a5c96a3eb038082c2e2b

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\ja\SqlPersistenceProviderLogic.sql

Filesize
13KB

MD5
a1da1f29d87ae902c8ba6de8b118b5d7

SHA1
667d757a42c075ccd4ea183e0cc5fde9e14be331

SHA256
ba40b27118258fe91b4de7e30d20527cc5689c2f0fcbd1769798dbac1d504942

SHA512
7decaa847e68905c8839115c5dedcce8245a8fb83f009403d23caf39ef31ee919a4223d0ab0c97e48806165258f35e2680046f652f49e1df2eddbb66b6faafb2

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\confirmation.ascx

Filesize
2KB

MD5
1657fbe1777629b4e2d5306018899632

SHA1
5ee86081e942ebc934f9957f20ef27c7fc28855a

SHA256
be939f825751c7308e384fd1325930799ada4684932da1a8c4570706a3883518

SHA512
1110d48ddd80ed00d7f052ca92c81e58cee44b2e31df77a6906f6e4b8f15177f5b809b361b8853152b151a9cf7c9adfb898e7d43fbf0a8c56a1cf07124c7e023

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\setUpAuthentication.aspx

Filesize
2KB

MD5
9b02d5c3c4b8562b1e86e2bf9aa07a93

SHA1
627f140c489af1095408ca00e22ad86cbcac7e34

SHA256
d389555a72d8d2b81e0ec63e3eb2880ffecceb70772ada21f4728bd583626866

SHA512
07c8934ea1a4b549d448cdf6d5f612b30b324aca2090b24a8dbef4366c54ca2f3f0b9d6841f16bc48a0abc3b61868052167c04503235b9b4bdb1eae3e538f112

Download Submit
C:\Windows\SysWOW64\update.bat

Filesize
88B

MD5
565ed1a1187f88ab0ea0f9963cb132a3

SHA1
786204682d8ebccee5261bc9d8d6d2c855364f92

SHA256
06057270cb58cb7b8827da881b87f6544bb06a36b78d7cc132bf710a79d8c5b3

SHA512
3d9ba6c240b3f00f0ca950668c150886283f99e033eb8d715106db11272b4af2c8ab53af29d2d389b34c7d4ef10dffd0d9e2734fa6df76b252ab8707c41340eb

Download Submit
C:\Windows\SysWOW64\update0.bat

Filesize
78B

MD5
397dc7373e23f1980ecf849a29708041

SHA1
6c91608ebe57a3d9375f646ff287e46a9f18c861

SHA256
3ffedf213b18d61561cdbdf3de6946284c7b0541a69a89ebda74add1aff7fd5a

SHA512
9c8cf8355cde0402b71fb4e713d14ed12a1031c3120b4a1af6e10ce02dd5828b8d27345ef28f40c34da329e47b36f4f0da74c7cd4cf3d3964d004a16e72096fb

Download Submit
\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

Filesize
21KB

MD5
fec89e9d2784b4c015fed6f5ae558e08

SHA1
581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

SHA256
489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

SHA512
e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

Download Submit
memory/596-1117-0x00000000004F0000-0x0000000000522000-memory.dmp

Filesize
200KB

Download
memory/596-1118-0x0000000000570000-0x00000000005A2000-memory.dmp

Filesize
200KB

Download
memory/1156-1374-0x0000000000990000-0x000000000099C000-memory.dmp

Filesize
48KB

Download
memory/2508-18-0x000007FEF6AE0000-0x000007FEF6B14000-memory.dmp

Filesize
208KB

Download
memory/2508-17-0x000000013FE60000-0x000000013FF58000-memory.dmp

Filesize
992KB

Download
memory/2508-19-0x000007FEF5980000-0x000007FEF5C36000-memory.dmp

Filesize
2.7MB

Download
memory/2508-20-0x000007FEF4510000-0x000007FEF55C0000-memory.dmp

Filesize
16.7MB

Download
memory/2632-978-0x00000000006C0000-0x00000000006F2000-memory.dmp

Filesize
200KB

Download
memory/2748-913-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-893-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-853-0x00000000021A0000-0x00000000021D2000-memory.dmp

Filesize
200KB

Download
memory/2748-854-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-861-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-859-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-899-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-904-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-863-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-911-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-909-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-907-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-902-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-897-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-857-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-887-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-895-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-852-0x0000000002170000-0x00000000021A2000-memory.dmp

Filesize
200KB

Download
memory/2748-891-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-889-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-886-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-883-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-881-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-879-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-877-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-855-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-905-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-876-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-873-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-871-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-1367-0x0000000002210000-0x000000000221E000-memory.dmp

Filesize
56KB

Download
memory/2748-869-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-867-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download
memory/2748-865-0x00000000021A0000-0x00000000021CB000-memory.dmp

Filesize
172KB

Download